AI agent sandbox options in 2026: the categories and how to choose

01The five categories at a glance

The vendor facts below come from each vendor's own documentation, linked under Sources. Products change quickly; check the current docs before you decide.

02Cloud sandbox services

You create a sandbox through an API or SDK, run the agent's code there, and pay for what you use. Nothing runs on your machine, and scaling to many sandboxes is the vendor's problem. Examples, in their own words:

• E2B describes a sandbox as a Linux VM created on demand for an agent, which can be paused and resumed.
• Daytona describes infrastructure for running AI-generated code, with sandboxes that have a dedicated kernel, filesystem, network stack and allocated vCPU, RAM and disk.
• Modal Sandboxes are containers for untrusted code that use gVisor by default, with a VM runtime that gives a sandbox its own Linux kernel when a workload needs one.
• Vercel Sandbox runs each sandbox in a Firecracker microVM with its own filesystem and network.

This fits when code and data may leave your network, and you want elastic capacity without running servers.

03Self-hosted isolation

You run the isolation layer yourself, usually on Linux servers with KVM, and build the scheduling, networking and logging around it.

• Firecracker runs in user space and uses Linux KVM to create microVMs. It is Apache-2.0 licensed, and AWS Lambda runs on it.
• Kata Containers builds lightweight VMs that plug into the container ecosystem, each with a dedicated kernel. It is Apache-2.0 licensed.
• gVisor can also be run on your own hosts (see user-space kernels below).

This fits when code and data must stay in your own infrastructure and you have a platform team to operate it.

04Local microVMs

The agent runs on your own laptop or workstation, inside a virtual machine with its own kernel, so a developer can keep the agent next to the code without giving it the host.

• Docker Sandboxes run each sandbox in a lightweight microVM with its own Linux kernel and its own Docker Engine. Docker also offers cloud sandboxes.
• kosa8 runs each sandbox as a microVM with its own Linux kernel on an Apple silicon Mac or x86-64 Linux, with a host-side network allow-list, API keys held outside the VM, approvals, a hash-chained audit log, and checkpoint, rewind and fork of a running machine.
• A full VM in Lima or UTM. Lima launches Linux virtual machines with automatic file sharing and port forwarding. A general-purpose VM gives the same kernel boundary, and you manage the guest yourself.

This fits when the code may not leave the machine, when you work offline, or when one developer wants isolation without a service to call.

05Containers

A Docker container separates processes with namespaces, cgroups, capabilities and seccomp, but every system call still goes to the host's kernel. Hardened (non-root, capabilities dropped, read-only, no network), it is the cheapest and most compatible option for code you have reviewed.

Agent tools also ship their own OS-level sandboxes. Claude Code's sandbox, for example, uses Seatbelt on macOS and bubblewrap on Linux and WSL2 to limit the shell commands it runs, with writes limited to the working directory by default and network traffic sent through a proxy that checks host names. It covers shell commands; its docs note that file tools, MCP servers and hooks run outside it.

06User-space kernels

gVisor is not a virtual machine. It is an application kernel that implements a Linux-like interface in user space, so the sandboxed program's system calls are handled by gVisor rather than directly by the host kernel. Its runtime, runsc, implements the OCI runtime interface and works with Docker and Kubernetes. It fits when you want a smaller host-kernel surface without running VMs, and can accept that some system calls are unsupported or slower.

07How to choose an AI agent sandbox

1. Where may the code and data go? If they must not leave your machine or network, rule out cloud services and look at local microVMs or self-hosted isolation.
2. Who wrote the code the agent runs? For reviewed code, a hardened container is often enough. For code nobody has reviewed, or an agent that installs packages on its own, prefer a separate kernel: a microVM, a VM, or gVisor.
3. Do you want to run infrastructure? A cloud service removes the operations work; self-hosting gives control at the cost of a platform to run.
4. What does the agent hold? Isolation does not stop an agent misusing an API key or an allowed network route. Check how each option handles secrets, network allow-lists and approvals, not only the kernel boundary.
5. What must you prove later? If auditors or customers will ask what an agent did, check what each option records and whether the record can be verified.
6. Scale and start time. Many short-lived sandboxes favour services and platforms built for that; one long-lived agent on a laptop favours a local option.

08Questions

What is the difference between a microVM and a container for an AI agent?

A microVM gives the agent its own guest kernel behind a hypervisor, so escaping needs a guest-kernel exploit and then a hypervisor exploit. A container shares the host's kernel, so one kernel or runtime bug can reach the host. Containers are lighter and more compatible; microVMs isolate more.

Should I use a cloud sandbox or a local one?

Use a cloud sandbox when code and data may leave your network and you want elastic capacity without running servers. Use a local or self-hosted one when they must stay on your machine or in your infrastructure, or when you need to work offline.

Is gVisor a virtual machine?

No. gVisor is an application kernel that runs in user space and handles a sandboxed program's system calls itself, instead of passing them straight to the host kernel. Some services pair it with a VM option for workloads that need a full Linux kernel.

Can I self-host an AI agent sandbox?

Yes. Firecracker and Kata Containers run microVMs on your own Linux servers with KVM, and gVisor runs on hosts you control. You then build the scheduling, networking and logging yourself, or use a product that runs on your own hardware.

09Guides and deep dives

• AI agent sandboxes in 2026: a map of the options
• Self-hosted AI sandbox options
• Docker containers vs microVMs: which isolates an AI agent better?
• How do I run an AI agent sandbox on my own machine instead of the cloud?
• How do I run untrusted LLM-generated code safely?
• kosa8 security: isolation model, releases and threat model

11Try it on your own machine

kosa8 installs with one line on macOS and Linux. Sandboxes run locally on Apple silicon Macs and x86-64 Linux.

Download kosa8 See pricing